@nano133/nanoterra 0.1.0 → 0.3.0

package/dist/admin/handler.js

@@ -0,0 +1,170 @@
+// The admin handler: the routes of /admin on the Web `Request` and `Response` types, so it fits a Worker, Firebase Functions and Node.
+//
+//   GET  {base}/summary   the numbers: status, orders, the looks that players own
+//   GET  {base}/game      the two switches
+//   POST {base}/game      a press: { character } or { signin } (only the two known words)
+//   POST {base}/check     the payment check, when the game gives one
+//
+// EVERY request under the base goes through `adminAccess` first, before the route is even looked up: a visitor who is not the owner gets 401 or 403
+// for any path, a real one or not, and learns nothing about the routes. The handler sets no CORS header. A POST must come from the game's own page.
+import { adminAccess } from "./guard.js";
+import { fail, foreignOrigin, json, memoryLimiter, readLimited, sameOrigin } from "./http.js";
+import { ADMIN_LOGINS_SHOWN } from "./store.js";
+import { mergeSettings, parsePatch } from "./switches.js";
+/** A browser name as the list shows it: words ("Chrome on macOS"). Anything else a store gives (a raw browser text, an address) is shown as "Unknown browser". */
+const BROWSER_NAME = /^[A-Za-z][A-Za-z ]{0,39}$/;
+/** The limits of the writes. */
+export const ADMIN_LIMITS = {
+    /** A press on a switch. */
+    game: { limit: 30, windowMs: 60_000 },
+    /** A payment check. */
+    check: { limit: 20, windowMs: 60_000 },
+    /** "Sign out everywhere". */
+    signOutAll: { limit: 5, windowMs: 60_000 },
+    /** The biggest body a press can have. */
+    gameBodyMax: 512,
+};
+/**
+ * Whether a request path could be read as under the admin base by anything: in any case, with backslashes for slashes, doubled slashes, and percent codes (decoded again and
+ * again, a code at a time, so one bad code does not stop the rest). Used ONLY to decide that a request is the admin's, so that the guard answers it. A path that is still
+ * changing after ten decodings is not an honest path: it is the admin's too (the guard refuses it). The route match later is exact on the parsed path.
+ */
+function readsAsBase(raw, base) {
+    let p = raw;
+    for (let i = 0; i < 10; i++) {
+        const plain = p.toLowerCase().replace(/\\/g, "/").replace(/\/{2,}/g, "/");
+        if (plain === base || plain.startsWith(`${base}/`))
+            return true;
+        const decoded = p.replace(/%([0-9a-f]{2})/gi, (_, hex) => String.fromCharCode(parseInt(hex, 16)));
+        if (decoded === p)
+            return false;
+        p = decoded;
+    }
+    return true;
+}
+/** The default limiter lives at module level: a Worker makes a handler for each request, and a limiter made inside it would forget every press. */
+const sharedLimit = memoryLimiter();
+export function createAdminHandler(options) {
+    const base = (options.basePath ?? "/api/admin").toLowerCase();
+    if (!base.startsWith("/") || base.length < 2 || base.endsWith("/"))
+        throw new Error('basePath must start with "/" and not end with "/", like "/api/admin"');
+    const now = options.now ?? (() => Date.now());
+    const limit = options.limit ?? sharedLimit;
+    /** The key of a limit: the base path and the owner come first, so two games in one process never share a count. */
+    const lkey = (name) => `${base}|${options.owner ?? ""}|${name}`;
+    const routes = [
+        { method: "GET", path: `${base}/summary` },
+        { method: "GET", path: `${base}/game` },
+        { method: "POST", path: `${base}/game` },
+        ...(options.check ? [{ method: "POST", path: `${base}/check` }] : []),
+        ...(options.store.signOutEverywhere ? [{ method: "POST", path: `${base}/signout-all` }] : []),
+    ];
+    const settings = async () => mergeSettings(await options.store.readSettings(), options.defaults);
+    async function summary(at) {
+        const s = await options.store.summary(at);
+        const status = options.status ? await options.status(at, s) : { address: options.owner, testMode: false, warnings: [] };
+        const name = (id) => options.lookName?.(id) ?? id;
+        const orders = s.orders.map((o) => ({ ...o, look: name(o.lookId) }));
+        const players = s.players.map((p) => ({ player: p.player, looks: p.looks.map((l) => ({ id: l.id, name: name(l.id), at: l.at })) }));
+        const out = { ...status, counts: s.counts, totals: s.totals, rate: s.rate, orders, players, canCheck: Boolean(options.check) };
+        if (options.store.recentLogins) {
+            // Only the three things of a sign-in go out, whatever the store gave (a store that returns an address or a browser text by mistake does not show it).
+            const rows = await options.store.recentLogins(ADMIN_LOGINS_SHOWN);
+            out.logins = rows.slice(0, ADMIN_LOGINS_SHOWN).map((l) => ({ at: Number(l.at), country: typeof l.country === "string" && /^[A-Z]{2}$/.test(l.country) ? l.country : null, browser: typeof l.browser === "string" && BROWSER_NAME.test(l.browser) ? l.browser : "Unknown browser" }));
+        }
+        if (options.store.signOutEverywhere)
+            out.canSignOutEverywhere = true;
+        return out;
+    }
+    /** Tells the game about a fault. A fault in the game's own `onError` is not the visitor's business: it is swallowed. */
+    const report = (e) => {
+        try {
+            options.onError?.(e);
+        }
+        catch {
+            // nothing more can be done
+        }
+    };
+    async function handle(req) {
+        const url = new URL(req.url);
+        if (!readsAsBase(url.pathname, base))
+            return null;
+        try {
+            const at = now();
+            // 1. The guard, before anything else.
+            let session;
+            try {
+                session = await options.session(req, at);
+            }
+            catch (e) {
+                report(e);
+                // The game could not read its sessions: nobody is let in.
+                return fail(503, "The game's server could not check your sign-in. Try again.");
+            }
+            const access = adminAccess({ owner: options.owner, session, now: at, maxAgeMs: options.maxAgeMs });
+            if (!access.ok) {
+                const { status, error, reason, signedInAs } = access;
+                return fail(status, error, { ...(reason ? { reason } : {}), ...(signedInAs ? { signedInAs } : {}) });
+            }
+            // 2. The route: an exact path (as the handler lists it), else 404 or 405.
+            const exact = url.pathname;
+            const known = routes.filter((r) => r.path === exact);
+            if (!known.length)
+                return fail(404, "No such admin page.");
+            const route = known.find((r) => r.method === req.method);
+            if (!route)
+                return fail(405, "Not allowed.", {}, { Allow: known.map((r) => r.method).join(", ") });
+            // 3. The call must come from the game's own page: a write must say so (Origin, or Sec-Fetch-Site same-origin); a read must not say it comes from another page.
+            if (route.method === "POST" ? !sameOrigin(req) : foreignOrigin(req))
+                return fail(403, "This call must come from the game's own page.");
+            if (route.method === "GET" && route.path === `${base}/summary`)
+                return json(await summary(at));
+            if (route.method === "GET")
+                return json(await settings());
+            if (route.path === `${base}/game`) {
+                if (!(await limit(lkey("admin-game"), ADMIN_LIMITS.game.limit, ADMIN_LIMITS.game.windowMs, at)))
+                    return fail(429, "Too many presses. Wait a minute.");
+                const text = await readLimited(req, ADMIN_LIMITS.gameBodyMax);
+                if (text === null)
+                    return fail(413, "That is too much to send.");
+                let body;
+                try {
+                    body = JSON.parse(text);
+                }
+                catch {
+                    return fail(400, "Send JSON.");
+                }
+                const parsed = parsePatch(body);
+                if (!parsed.ok)
+                    return fail(400, parsed.error);
+                await options.store.saveSettings(parsed.patch, at);
+                return json(await settings());
+            }
+            if (route.path === `${base}/signout-all`) {
+                if (!(await limit(lkey("admin-signout-all"), ADMIN_LIMITS.signOutAll.limit, ADMIN_LIMITS.signOutAll.windowMs, at)))
+                    return fail(429, "Too many tries. Wait a minute.");
+                const n = await options.store.signOutEverywhere();
+                return json({ ok: true, signedOut: n });
+            }
+            // POST check
+            if (!(await limit(lkey("admin-check"), ADMIN_LIMITS.check.limit, ADMIN_LIMITS.check.windowMs, at)))
+                return fail(429, "Too many checks. Wait a minute.");
+            const scan = await options.check(at);
+            return json({ scan, summary: await summary(now()) });
+        }
+        catch (e) {
+            report(e);
+            return fail(500, "The game's server could not do that. Nothing was changed that you can see here.");
+        }
+    }
+    return { routes, basePath: options.basePath ?? "/api/admin", handle };
+}
+/** The settings as the game's own routes need them (the listing file, the character): the stored words, or the game's defaults. A fault in the store gives the defaults. */
+export async function loadGameSettings(store, defaults) {
+    try {
+        return mergeSettings(await store.readSettings(), defaults);
+    }
+    catch {
+        return mergeSettings({}, defaults);
+    }
+}

package/dist/admin/http.d.ts

@@ -0,0 +1,17 @@
+export declare function json(data: unknown, status?: number, headers?: Record<string, string>): Response;
+export declare const fail: (status: number, error: string, extra?: Record<string, unknown>, headers?: Record<string, string>) => Response;
+/**
+ * True when the browser says the request comes from this game's own pages. A call that changes something must pass this, so another site
+ * cannot make the owner's browser do it. The browser sets Origin on a POST; a request with no Origin must say Sec-Fetch-Site: same-origin.
+ */
+export declare function sameOrigin(req: Request): boolean;
+/**
+ * True when the browser says a request did NOT come from this game's own pages: an Origin that is not the game's (any value, "null" too), or Sec-Fetch-Site "cross-site" or
+ * "same-site" (a sibling subdomain is same-site and has the game's cookies). A request with neither header (a command-line tool; a browser's own address bar says "none") is not foreign.
+ * The admin API is called only by its own page, so a read that is foreign is refused too: whatever CORS headers the game's router might add, the answer is not for another page.
+ */
+export declare function foreignOrigin(req: Request): boolean;
+/** The text of a body of at most `max` bytes, or null when it is bigger. It stops reading at the limit: a body with no length cannot fill the memory. */
+export declare function readLimited(req: Request, max: number): Promise<string | null>;
+/** A fixed-window limiter in memory. True while `key` has made at most `limit` calls in this window. Each copy of a server counts for itself. */
+export declare function memoryLimiter(): (key: string, limit: number, windowMs: number, now: number) => boolean;

package/dist/admin/http.js

@@ -0,0 +1,76 @@
+// Small helpers for the handler. Web APIs only (they run in Workers, Firebase Functions and Node).
+export function json(data, status = 200, headers = {}) {
+    return new Response(JSON.stringify(data), {
+        status,
+        headers: { "Content-Type": "application/json; charset=utf-8", "Cache-Control": "no-store", "X-Content-Type-Options": "nosniff", ...headers },
+    });
+}
+export const fail = (status, error, extra = {}, headers = {}) => json({ error, ...extra }, status, headers);
+/**
+ * True when the browser says the request comes from this game's own pages. A call that changes something must pass this, so another site
+ * cannot make the owner's browser do it. The browser sets Origin on a POST; a request with no Origin must say Sec-Fetch-Site: same-origin.
+ */
+export function sameOrigin(req) {
+    const origin = req.headers.get("Origin");
+    if (origin !== null)
+        return origin === new URL(req.url).origin;
+    return req.headers.get("Sec-Fetch-Site") === "same-origin";
+}
+/**
+ * True when the browser says a request did NOT come from this game's own pages: an Origin that is not the game's (any value, "null" too), or Sec-Fetch-Site "cross-site" or
+ * "same-site" (a sibling subdomain is same-site and has the game's cookies). A request with neither header (a command-line tool; a browser's own address bar says "none") is not foreign.
+ * The admin API is called only by its own page, so a read that is foreign is refused too: whatever CORS headers the game's router might add, the answer is not for another page.
+ */
+export function foreignOrigin(req) {
+    const origin = req.headers.get("Origin");
+    if (origin !== null && origin !== new URL(req.url).origin)
+        return true;
+    const site = req.headers.get("Sec-Fetch-Site");
+    return site === "cross-site" || site === "same-site";
+}
+/** The text of a body of at most `max` bytes, or null when it is bigger. It stops reading at the limit: a body with no length cannot fill the memory. */
+export async function readLimited(req, max) {
+    const declared = req.headers.get("Content-Length");
+    if (declared !== null && (!/^\d+$/.test(declared) || Number(declared) > max))
+        return null;
+    if (!req.body)
+        return "";
+    const reader = req.body.getReader();
+    const parts = [];
+    let size = 0;
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        size += value.byteLength;
+        if (size > max) {
+            await reader.cancel().catch(() => undefined);
+            return null;
+        }
+        parts.push(value);
+    }
+    const all = new Uint8Array(size);
+    let at = 0;
+    for (const p of parts) {
+        all.set(p, at);
+        at += p.byteLength;
+    }
+    return new TextDecoder().decode(all);
+}
+/** A fixed-window limiter in memory. True while `key` has made at most `limit` calls in this window. Each copy of a server counts for itself. */
+export function memoryLimiter() {
+    const hits = new Map();
+    return (key, limit, windowMs, now) => {
+        const hit = hits.get(key);
+        if (!hit || hit.until <= now) {
+            if (hits.size > 1000)
+                for (const [k, v] of hits)
+                    if (v.until <= now)
+                        hits.delete(k);
+            hits.set(key, { count: 1, until: now + windowMs });
+            return true;
+        }
+        hit.count += 1;
+        return hit.count <= limit;
+    };
+}

package/dist/admin/index.d.ts

@@ -0,0 +1,13 @@
+export { ADMIN_SESSION_MS, CLOCK_SKEW_MS, OWNER_PATTERN, adminAccess } from "./guard.js";
+export type { AdminAccess, AdminAccessInput, AdminRefusal, AdminSession } from "./guard.js";
+export { ADMIN_LIMITS, createAdminHandler, loadGameSettings } from "./handler.js";
+export type { AdminHandler, AdminHandlerOptions, AdminRoute } from "./handler.js";
+export { createMemoryStore } from "./memory.js";
+export type { MemoryStore } from "./memory.js";
+export { ADMIN_LOGINS_SHOWN } from "./store.js";
+export type { AdminLogin, AdminOrder, AdminPlayer, AdminStatus, AdminStore, AdminSummary, Money, OrderStatus, StoreSummary } from "./store.js";
+export { ORDERS_SHOWN, moneyOf, parseRate, shapeOrders, shapePlayers, statusOf, summarize } from "./summary.js";
+export type { OrderRow } from "./summary.js";
+export { RAW_PER_XNO, xnoText } from "./amount.js";
+export { CHARACTER_NEEDS_SIGNIN, CHARACTER_SIGNIN_OFF, REVIEW_LINK, REVIEW_NOTE, SWITCHES, isCharacter, isSignin, isSigninChoice, mergeSettings, parsePatch, pressOf, signinOn, stateOf } from "./switches.js";
+export type { Character, GamePatch, GameSettings, GameState, Signin, SwitchId } from "./switches.js";

package/dist/admin/index.js

@@ -0,0 +1,14 @@
+// "@nano133/nanoterra/admin": the admin of a game, in the package. No Three.js, no database, no cookie: the game gives a session and a store.
+//
+//   adminAccess            the guard: one pure function, who may open /admin
+//   createAdminHandler     the routes, on Request and Response
+//   loadGameSettings       the two switches for the game's own routes
+//   createMemoryStore      a store in memory, for tests
+//   (the conformance suite is its own path: "@nano133/nanoterra/admin/conformance"; the adapters are "/admin/d1" and "/admin/firestore")
+export { ADMIN_SESSION_MS, CLOCK_SKEW_MS, OWNER_PATTERN, adminAccess } from "./guard.js";
+export { ADMIN_LIMITS, createAdminHandler, loadGameSettings } from "./handler.js";
+export { createMemoryStore } from "./memory.js";
+export { ADMIN_LOGINS_SHOWN } from "./store.js";
+export { ORDERS_SHOWN, moneyOf, parseRate, shapeOrders, shapePlayers, statusOf, summarize } from "./summary.js";
+export { RAW_PER_XNO, xnoText } from "./amount.js";
+export { CHARACTER_NEEDS_SIGNIN, CHARACTER_SIGNIN_OFF, REVIEW_LINK, REVIEW_NOTE, SWITCHES, isCharacter, isSignin, isSigninChoice, mergeSettings, parsePatch, pressOf, signinOn, stateOf } from "./switches.js";

package/dist/admin/memory.d.ts

@@ -0,0 +1,32 @@
+import { type OrderRow } from "./summary.js";
+import type { AdminLogin, AdminStore, StoreSummary } from "./store.js";
+export type MemoryStore = AdminStore & {
+    /** The rows as an adapter would keep them in its meta table. */
+    readonly rows: Map<string, string>;
+    /** How many writes were made. */
+    writes: number;
+    orders: OrderRow[];
+    owned: {
+        player: string;
+        lookId: string;
+        at: number;
+    }[];
+    rate: StoreSummary["rate"];
+    /** The admin sign-ins and the count of admin sessions, when the store was made with `logins: true`. */
+    logins: (AdminLogin & Record<string, unknown>)[];
+    adminSessions: number;
+    playSessions: number;
+    /** Admin sign-in requests started and not delivered, and the game's own: "sign out everywhere" ends the first and leaves the second. */
+    pendingAdminRequests: number;
+    pendingGameRequests: number;
+};
+export declare function createMemoryStore(seed?: {
+    orders?: OrderRow[];
+    owned?: {
+        player: string;
+        lookId: string;
+        at: number;
+    }[];
+    rate?: StoreSummary["rate"];
+    logins?: boolean;
+}): MemoryStore;

package/dist/admin/memory.js

@@ -0,0 +1,40 @@
+// A store in memory, for tests (and for a game's first try). Nothing is kept after the process ends. It builds its summary with the same code as the
+// real adapters (./summary.ts), so it is the reference for what a summary says.
+import { summarize } from "./summary.js";
+export function createMemoryStore(seed = {}) {
+    const store = {
+        rows: new Map(),
+        writes: 0,
+        orders: seed.orders ?? [],
+        owned: seed.owned ?? [],
+        rate: seed.rate ?? null,
+        logins: [],
+        adminSessions: 0,
+        playSessions: 0,
+        pendingAdminRequests: 0,
+        pendingGameRequests: 0,
+        async readSettings() {
+            return { character: store.rows.get("setting:character"), signin: store.rows.get("setting:signin") };
+        },
+        async saveSettings(patch) {
+            if (patch.character)
+                store.rows.set("setting:character", patch.character);
+            if (patch.signin)
+                store.rows.set("setting:signin", patch.signin);
+            store.writes++;
+        },
+        async summary(now) {
+            return summarize(store.orders, store.owned, store.rate, now);
+        },
+    };
+    if (seed.logins) {
+        store.recentLogins = async (limit) => [...store.logins].sort((a, b) => b.at - a.at).slice(0, limit);
+        store.signOutEverywhere = async () => {
+            const n = store.adminSessions;
+            store.adminSessions = 0;
+            store.pendingAdminRequests = 0;
+            return n;
+        };
+    }
+    return store;
+}

package/dist/admin/panel/api.d.ts

@@ -0,0 +1,11 @@
+export declare class ApiError extends Error {
+    status: number;
+    body: Record<string, unknown>;
+    constructor(status: number, message: string, body?: Record<string, unknown>);
+}
+export type Api = {
+    get<T>(path: string): Promise<T>;
+    post<T>(path: string, body?: unknown): Promise<T>;
+};
+/** The calls of the admin: `base` is where the routes are ("/api/admin"), `send` is `fetch` (a test gives its own). */
+export declare function createApi(base: string, send?: typeof fetch): Api;

package/dist/admin/panel/api.js

@@ -0,0 +1,33 @@
+// Calls to the game's own server. Cookies stay on this site; nothing goes to another server.
+export class ApiError extends Error {
+    status;
+    body;
+    constructor(status, message, body = {}) {
+        super(message);
+        this.status = status;
+        this.body = body;
+    }
+}
+/** The calls of the admin: `base` is where the routes are ("/api/admin"), `send` is `fetch` (a test gives its own). */
+export function createApi(base, send = (...a) => fetch(...a)) {
+    async function call(path, init = {}) {
+        const res = await send(`${base}${path}`, { credentials: "same-origin", ...init, headers: { "Content-Type": "application/json", ...(init.headers ?? {}) } });
+        const text = await res.text();
+        let body = {};
+        try {
+            const v = text ? JSON.parse(text) : {};
+            if (v && typeof v === "object")
+                body = v;
+        }
+        catch {
+            body = {};
+        }
+        if (!res.ok)
+            throw new ApiError(res.status, typeof body.error === "string" ? body.error : `The server answered ${res.status}. Try again.`, body);
+        return body;
+    }
+    return {
+        get: (path) => call(path),
+        post: (path, body = {}) => call(path, { method: "POST", body: JSON.stringify(body) }),
+    };
+}

package/dist/admin/panel/dom.d.ts

@@ -0,0 +1,7 @@
+type Attrs = Record<string, string | number | boolean | undefined | ((e: Event) => void)>;
+type Child = Node | string | null | undefined | false;
+export declare function h<K extends keyof HTMLElementTagNameMap>(tag: K, attrs?: Attrs, ...children: Child[]): HTMLElementTagNameMap[K];
+/** "nano_1abc…wxyz" */
+export declare const shortAddress: (a: string) => string;
+export declare function copy(text: string, button: HTMLButtonElement): Promise<void>;
+export {};

package/dist/admin/panel/dom.js

@@ -0,0 +1,33 @@
+// A tiny helper to build page elements without innerHTML (safe for any text, and fine under a strict CSP). The panel runs in a browser.
+export function h(tag, attrs = {}, ...children) {
+    const el = document.createElement(tag);
+    for (const [k, v] of Object.entries(attrs)) {
+        if (v === undefined || v === false)
+            continue;
+        if (typeof v === "function")
+            el.addEventListener(k.replace(/^on/, ""), v);
+        else if (k === "class")
+            el.className = String(v);
+        else if (v === true)
+            el.setAttribute(k, "");
+        else
+            el.setAttribute(k, String(v));
+    }
+    for (const c of children)
+        if (c !== null && c !== undefined && c !== false)
+            el.append(c);
+    return el;
+}
+/** "nano_1abc…wxyz" */
+export const shortAddress = (a) => `${a.slice(0, 10)}…${a.slice(-6)}`;
+export async function copy(text, button) {
+    const was = button.textContent;
+    try {
+        await navigator.clipboard.writeText(text);
+        button.textContent = "Copied";
+    }
+    catch {
+        button.textContent = "Copy failed";
+    }
+    setTimeout(() => (button.textContent = was), 1500);
+}

package/dist/admin/panel/gameCard.d.ts

@@ -0,0 +1,4 @@
+import { type GameState } from "../switches.js";
+import { type Api } from "./api.js";
+/** The card for the settings `initial`. It keeps its own state: a press shows "Saving…", then "Saved." or the server's words. `defaultsFile` is where the game's defaults are written ("game.config.json"). */
+export declare function gameCard(api: Api, initial: GameState, defaultsFile?: string): HTMLElement;

package/dist/admin/panel/gameCard.js

@@ -0,0 +1,56 @@
+// The "Game" card of /admin: two switches, "Players use their Nanoterra character" and "Players can sign in with Nanoterra". A press saves at once
+// (POST {api}/game, behind the same admin guard as every admin call) and the game reads the setting at run time, so the creator pushes and deploys
+// nothing. The words are in ../switches.ts. The card changes ONLY these two settings: never a look, a price or an order.
+import { CHARACTER_NEEDS_SIGNIN, CHARACTER_SIGNIN_OFF, REVIEW_LINK, REVIEW_NOTE, SWITCHES, pressOf, signinOn, stateOf } from "../switches.js";
+import { ApiError } from "./api.js";
+import { h } from "./dom.js";
+/** The card for the settings `initial`. It keeps its own state: a press shows "Saving…", then "Saved." or the server's words. `defaultsFile` is where the game's defaults are written ("game.config.json"). */
+export function gameCard(api, initial, defaultsFile = "the game's own settings") {
+    let state = initial;
+    const rows = new Map();
+    /** Under the character switch: it works only through sign-in, so it says so, and says what a player gets while sign-in is Off. */
+    const needs = h("p", { class: "fine switch-needs" });
+    const card = h("section", { class: "admin-card game-card", "aria-labelledby": "game-title" }, h("h2", { id: "game-title" }, "Game"));
+    card.append(h("p", { class: "fine" }, `Two choices about your game. A press saves at once: you push nothing and deploy nothing. They start from ${defaultsFile}, and a press here wins.`));
+    const draw = () => {
+        for (const [id, row] of rows) {
+            const on = stateOf(id, state);
+            row.button.setAttribute("aria-checked", on ? "true" : "false");
+            row.button.classList.toggle("switch-on", on);
+            row.button.querySelector(".switch-word").textContent = on ? "On" : "Off";
+            row.sentence.textContent = on ? SWITCHES[id].on : SWITCHES[id].off;
+        }
+        needs.hidden = !stateOf("character", state);
+        needs.textContent = signinOn(state.signin) ? CHARACTER_NEEDS_SIGNIN : CHARACTER_SIGNIN_OFF;
+    };
+    const press = async (id) => {
+        const row = rows.get(id);
+        row.button.disabled = true;
+        row.status.textContent = "Saving…";
+        try {
+            state = await api.post("/game", pressOf(id, state));
+            row.status.textContent = "Saved.";
+            draw();
+        }
+        catch (e) {
+            row.status.textContent = e instanceof ApiError ? e.message : "The game's server did not answer. Nothing was changed.";
+        }
+        finally {
+            row.button.disabled = false;
+        }
+    };
+    for (const id of ["character", "signin"]) {
+        const label = h("span", { class: "switch-title", id: `switch-${id}-label` }, SWITCHES[id].title);
+        const button = h("button", { class: "switch", type: "button", role: "switch", "aria-checked": "false", "aria-labelledby": `switch-${id}-label`, "aria-describedby": `switch-${id}-note` }, h("span", { class: "switch-word" }, "Off"), h("span", { class: "switch-knob", "aria-hidden": "true" }));
+        const sentence = h("p", { class: "switch-note", id: `switch-${id}-note` });
+        const status = h("span", { class: "fine", role: "status", "aria-live": "polite" });
+        button.addEventListener("click", () => void press(id));
+        rows.set(id, { button, sentence, status });
+        card.append(h("div", { class: "switch-row" }, h("div", { class: "switch-head" }, label, button), sentence, id === "character" ? needs : null, status));
+        // The sign-in word is part of the listing file: Nanoterra's review decides what Nanoterra shows. This page cannot see that review.
+        if (id === "signin")
+            card.append(h("p", { class: "fine switch-review" }, REVIEW_NOTE, " ", h("a", { href: REVIEW_LINK, target: "_blank", rel: "noopener noreferrer" }, "Open the launch page")));
+    }
+    draw();
+    return card;
+}

package/dist/admin/panel/index.d.ts

@@ -0,0 +1,10 @@
+export { mountAdmin } from "./mount.js";
+export type { MountedAdmin, MountOptions } from "./mount.js";
+export { ApiError, createApi } from "./api.js";
+export type { Api } from "./api.js";
+export { gameCard } from "./gameCard.js";
+export { lookPicture, previewPicture, shelfView } from "./shelf.js";
+export { DEFAULT_LOGINS_NOTE, signinsCard } from "./signins.js";
+export type { ShelfData } from "./shelf.js";
+export { aiPrompt, centsOf, changeText, ownedIds, shelfStats, soldText } from "./shelfData.js";
+export type { LookStats, ShelfOrder, ShelfPlayer } from "./shelfData.js";

package/dist/admin/panel/index.js

@@ -0,0 +1,13 @@
+// "@nano133/nanoterra/admin/panel": the admin page of a game, drawn in the browser into one element. Plain DOM, no framework, no Three.js.
+//
+//   import { mountAdmin } from "@nano133/nanoterra/admin/panel";
+//   import "@nano133/nanoterra/admin/style.css";
+//   mountAdmin(document.getElementById("admin")!, { looks, signIn, signOut });
+//
+// The server part is "@nano133/nanoterra/admin" (the guard and the handler): it must not load this one.
+export { mountAdmin } from "./mount.js";
+export { ApiError, createApi } from "./api.js";
+export { gameCard } from "./gameCard.js";
+export { lookPicture, previewPicture, shelfView } from "./shelf.js";
+export { DEFAULT_LOGINS_NOTE, signinsCard } from "./signins.js";
+export { aiPrompt, centsOf, changeText, ownedIds, shelfStats, soldText } from "./shelfData.js";

package/dist/admin/panel/mount.d.ts

@@ -0,0 +1,30 @@
+import type { Look } from "../../looks/look.js";
+export type MountOptions = {
+    /** The game's looks now (its looks.json). The Shelf starts from them. */
+    looks: readonly Look[];
+    /** Draws the wallet sign-in of the game into `into` and calls `done` when the owner has signed in. Only a wallet signature opens the admin: use the game's admin scope. */
+    signIn: (into: HTMLElement, done: () => void) => void;
+    /** Signs out of the ADMIN login only (the game's own login, another person's perhaps, stays). */
+    signOut: () => Promise<unknown>;
+    /** Where the routes are (the handler's basePath). Default "/api/admin". */
+    api?: string;
+    /** What to tell a game that has no owner address yet. */
+    noAddressHelp?: string;
+    /** Where the game's default switches are written ("game.config.json"). */
+    defaultsFile?: string;
+    /** A picture of a look for the Shelf (default: a flat one). */
+    lookPicture?: (look: Look) => Element;
+    /** What the Shelf says when the status gives no repository. */
+    repoHelp?: string;
+    /** What the Sign-ins card says about what the game keeps and for how long ("30 days"). Default: only the time, the rough country and a short browser name. */
+    loginsNote?: string;
+    /** The `fetch` to use (default: the page's). */
+    fetch?: typeof fetch;
+};
+export type MountedAdmin = {
+    /** Reads everything again and redraws. */
+    reload(): Promise<void>;
+    /** Resolves when the first read has been drawn (a test waits for it). */
+    ready: Promise<void>;
+};
+export declare function mountAdmin(root: HTMLElement, options: MountOptions): MountedAdmin;